tres($meta, TEST_SKIPPED, "error_log invalid or relative path.");
} elseif ($document_root_realpath === FALSE) {
tres($meta, TEST_SKIPPED, "DOCUMENT_ROOT invalid or relative path.");
} elseif (strpos($error_log_realpath, $document_root_realpath) === 0) {
tres($meta, TEST_HIGH, "error_log in DOCUMENT_ROOT.", "The error logfile is located inside the document root directory and may be accessible publicly. The error_log should point to a file outside the document root.");
} else {
tres($meta, TEST_OK, "error_log outside of DOCUMENT_ROOT.");
}
}
// writable document root?
$meta = tdesc("Writable document root", "Checks if the current document root is writable");
if (!isset($_SERVER['DOCUMENT_ROOT'])) {
tres($meta, TEST_SKIPPED, "DOCUMENT_ROOT not set.");
} elseif (is_writable($_SERVER['DOCUMENT_ROOT'])) {
tres($meta, TEST_HIGH, "document root is writable.", "Making the document root writable may give an attacker the advantage of persisting an exploit. It is probably best to restrict write access to the document root and its subdirectories. Temporary files your application may need to write can be safely stored outside the document root.");
} elseif (is_writable_or_chmodable($_SERVER['DOCUMENT_ROOT'])) {
tres($meta, TEST_MEDIUM, "document root is potentially writable.", "The document root's access permissions prevent write access, but the current user has the right to change these permissions. Please change the directory's owner.");
} else {
tres($meta, TEST_OK, "document root not writable.");
}
/*****************************************************************************/
// output
if ($cfg['output_type'] == "text") {
echo $cfg['s1_logo_aa'] . "\n\n";
if ($cfg['need_update']) {
echo "[*] This script is rather old. Please check for updates:\n {$pcc_url}\n\n";
}
foreach ($all_result_codes as $sev) {
if (!$cfg['showall'] && !in_array($sev, $cfg['result_codes_default'], true)) {
continue;
}
function test_sendmail_writable()
{
$meta = tdesc("sendmail writable", "Checks if the sendmail executable is writable");
$sm = ini_get('sendmail_path');
if ($sm == "" || $sm === NULL) {
tres($meta, TEST_OK, "sendmail_path not set.");
return;
}
$sm_chunks = explode(' ', $sm);
$sm_executable = $sm_chunks[0];
$sm_dir = dirname($sm_executable);
if (is_file($sm_executable) || is_link($sm_executable)) {
if (is_writable_or_chmodable($sm_executable)) {
tres($meta, TEST_CRITICAL, "sendmail is writable", "The configured sendmail_path can be changed by the current user. Please change its permissions.");
return;
}
}
if (is_writable_or_chmodable(dirname($sm_executable)) || is_writable_or_chmodable(dirname(realpath($sm_executable)))) {
tres($meta, TEST_CRITICAL, "The directory containing the sendmail_path executable is writable or its permission can be changed by the current user.");
return;
}
tres($meta, TEST_OK, "sendmail_path is not writable.");
}
